CVE-2026-45149

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45149
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-45149.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-45149
Aliases
Downstream
Related
Published
2026-05-29T19:55:07.337Z
Modified
2026-05-31T04:02:13.581746299Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
brace-expansion: Large numeric range defeats documented `max` DoS protection
Details

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop generates all 10 million intermediate elements before the max limit is applied With max=10, the output is correctly limited to 10 items, but the process still allocates ~505 MB and spends ~800ms building the full intermediate array. This vulnerability is fixed in 5.0.6.

Database specific 
{
    "cwe_ids": [
        "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45149.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/juliangruber/brace-expansion

Affected ranges

Type
GIT
Repo
https://github.com/juliangruber/brace-expansion
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
46317b5d8779c151d24f65c9c139cd076f91a1c3

Affected versions

1.*
1.1.11
v1.*
v1.0.0
v1.0.1
v1.1.0
v1.1.1
v1.1.10
v1.1.11
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.1.8
v1.1.9
v2.*
v2.0.0
v2.0.1
v3.*
v3.0.0
v4.*
v4.0.0
v4.0.1
v5.*
v5.0.2
v5.0.3
v5.0.4
v5.0.5

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-45149.json"